Monitoring a worker through the use of internet by his employer and the violation of his electronic mail violates his right to respect for privacy
JUDGMENT
Bărbulescu v. Romania 05-09-2017 (no. 61496/08)
SUMMARY
Privacy and employee communication. Online account tracking. Obligation to be informed and conditions for monitoring. Violation of the right to privacy.
Surveillance of a sales employee from a private company employing of the yahoo messenger service and the recording of his personal conversations with his brother and fiancé without knowing it and without informing him before the surveillance. After the discovery of his personal communications the company dismissed him. The Romanian courts ruled in favor of the company in an action brought by the applicant, who has applied before the Court.
The ECtHR considered that:
(a) the communication and means of communication of workers at their workplace are contained in the concepts of “privacy” and “correspondence” protected by Article 8 of the ECHR,
(b) The employer must warn the worker of the possibility of adopting monitoring measures and state the nature of the measures in question,
(c) the warning must be given before the start of the monitoring,
. (d) there must be legitimate reasons justifying the surveillance of communications; and
(e) national courts should seek if the employer could achieve its objectives by less intrusive methods
The Court found that Article 8 of the ECHR had been infringed.
USE
Particularly important decision by the European Court of Human Rights, which sets up a network for the protection of the privacy of workers in their workplace. The ECtHR in this case sets the basis for protecting employees’ privacy against arbitrary actions by employers, and in particular by monitoring them. In order to monitor employees, they must be informed before the start of their monitoring, identify the reasons for the action, have a legitimate reason for doing so. The ECtHR also instructs national courts to deal with these situations by laying down the necessary conditions to protect the privacy of workers. Finally, it shields the latter by integrating their personal social communications into the protective umbrella of Article 8 both at the time of their working time and at their workplace.
PROVISION
Article 8
PRINCIPAL FACTS
The applicant, Bogdan Mihai Bărbulescu, is a Romanian national who was born in 1979 and lives in Bucharest.
From 1 August 2004 until 6 August 2007 Mr Bărbulescu was employed by a private company as an engineer in charge of sales. At his employers’ request, he created a Yahoo Messenger account for the purpose of responding to clients’ enquiries.
On 3 July 2007 the company circulated an information notice among its employees which stated that one employee had been dismissed on disciplinary grounds after she had privately used the internet, the telephone and the photocopier.
On 13 July 2007 Mr Bărbulescu was summoned by his employer to give an explanation. He was informed that his Yahoo Messenger communications had been monitored and that there was evidence that he had used the internet for personal purposes. Mr Bărbulescu replied in writing that he had only used the service for professional purposes.
He was then presented with a transcript of 45 pages of his communications from 5 to 12 July 2007, consisting of messages he had exchanged with his brother and his fiancée relating to personal matters, some of the messages being of an intimate nature. On 1 August 2007 the employer terminated Mr Bărbulescu’s employment contract for breach of the company’s internal regulations that prohibited the use of company resources for personal purposes.
Mr Bărbulescu challenged his employer’s decision before the courts, complaining that the decision to terminate his contract was null and void as his employer had violated his right to correspondence in accessing his communications in breach of the Constitution and Criminal Code. His complaint was rejected by the Bucharest County Court in December 2007, on the grounds, in particular, that the employer had complied with the dismissal proceedings provided for by the Labour Code; that employers were entitled to set rules for the use of the internet, which was a tool made available to employees for professional use; and that Mr Bărbulescu had been duly informed of the company’s regulations. The County Court noted that shortly before Mr Bărbulescu’s disciplinary sanction, another employee had been dismissed for using the internet, the telephone and the photocopier for personal purposes.
Mr Bărbulescu appealed, contending that the court had not struck a fair balance between the interests at stake. In a final decision on 17 June 2008 the Court of Appeal dismissed his appeal. It essentially confirmed the lower court’s findings. Referring to European Union Directive 95/46/EC on data protection, it held that the employer’s conduct, after having warned Mr Bărbulescu and his colleagues that company resources should not be used for personal purposes, had been reasonable and that the monitoring of Mr Bărbulescu’s communications had been the only method of establishing whether there had been a disciplinary breach.
THE DECISION OF THE COURT
Article 8
The Court confirmed that Article 8 was applicable in Mr Bărbulescu’s case, concluding that his communications in the workplace had been covered by the concepts of “private life” and “correspondence”. It noted in particular that, although it was questionable whether Mr Bărbulescu could have had a reasonable expectation of privacy in view of his employer’s restrictive regulations on internet use, of which he had been informed, an employer’s instructions could not reduce private social life in the workplace to zero. The right to respect for private life and for the privacy of correspondence continued to exist, even if these might be restricted in so far as necessary.
While the measure complained of, namely the monitoring of Mr Bărbulescu’s communications which resulted in his dismissal, had been taken by a private company, it had been accepted by the national courts. The Court therefore considered that the complaint was to be examined from the standpoint of the State’s positive obligations. The national authorities had been required to carry out a balancing exercise between the competing interests at stake, namely Mr Bărbulescu’s right to respect for his private life, on the one hand, and his employer’s right to take measures in order to ensure the smooth running of the company, on the other.
As to the resulting question of whether the national authorities had struck a fair balance between those interests, the Court first observed that the national courts had expressly referred to Mr Bărbulescu’s right to respect for his private life and to the applicable legal principles. Notably the Court of Appeal had made reference to the relevant European Union Directive and the principles set forth in it, namely necessity, purpose specification, transparency, legitimacy, proportionality and security. The national courts had also examined whether the disciplinary proceedings had been conducted in an adversarial manner and whether Mr Bărbulescu had been given the opportunity to put forward his arguments.
However, the national courts had omitted to determine whether Mr Bărbulescu had been notified in advance of the possibility that his employer might introduce monitoring measures, and of the nature of such measures. The County Court had simply observed that employees’ attention had been drawn to the fact that, shortly before Mr Bărbulescu’s disciplinary sanction, another employee had been dismissed for using the internet, the telephone and the photocopier for personal purposes.
The Court of Appeal had found that he had been warned that he should not use company resources for personal purposes. The Court considered, following international and European standards, that to qualify as prior notice, the warning from an employer had to be given before the monitoring was initiated, especially where it entailed accessing the contents of employees’ communications. The Court concluded, from the material in the case file, that Mr Bărbulescu had not been informed in advance of the extent and nature of his employer’s monitoring, or the possibility that the employer might have access to the actual contents of his messages.
As to the scope of the monitoring and the degree of intrusion into Mr Bărbulescu’s privacy, this question had not been examined by either of the national courts, even though the employer had recorded all communications of Mr Bărbulescu during the monitoring period in real time and had printed out their contents.
Nor had the national courts carried out a sufficient assessment of whether there had been legitimate reasons to justify monitoring Mr Bărbulescu’s communications. The County Court had referred, in particular, to the need to avoid the company’s IT systems being damaged or liability being incurred by the company in the event of illegal activities online. However, these examples could only be seen as theoretical, since there was no suggestion that Mr Bărbulescu had actually exposed the company to any of those risks.
Furthermore, neither of the national courts had sufficiently examined whether the aim pursued by the employer could have been achieved by less intrusive methods than accessing the contents of Mr Bărbulescu’s communications. Moreover, neither court had considered the seriousness of the consequences of the monitoring and the subsequent disciplinary proceedings, namely the fact that – being dismissed – he had received the most severe disciplinary sanction. Finally, the courts had not established at what point during the disciplinary proceedings the employer had accessed the relevant content, in particular whether he had accessed the content at the time he summoned Mr Bărbulescu to give an explanation for his use of company resources.
Having regard to those considerations, the Court concluded that the national authorities had not adequately protected Mr Bărbulescu’s right to respect for his private life and correspondence and that they had consequently failed to strike a fair balance between the interests at stake. There had therefore been a violation of Article 8.
Just satisfaction (Article 41)
The Court held that the finding of a violation constituted in itself sufficient just satisfaction for the non-pecuniary damage sustained by Mr Bărbulescu. Separate opinions Judge Karakaş expressed a partly dissenting opinion. Judges Raimondi, Dedov, Kjølbro, Mits, Mourou-Vikström and Eicke expressed a joint dissenting opinion. These opinions are annexed to the judgment(echrcaselaw.com editing).
